Security, Compliance & Transparency

1. Security Posture

Data in transit is protected with TLS 1.3. Data at rest is encrypted with AES-256. All access to customer data is logged, scoped to least-privilege roles, and reviewed on a rolling basis.

Production systems require multi-factor authentication. Administrative access is gated by hardware security keys. Engineering access to production data is time-bound and audited.

Customer data processed by Brainiall Specialist AI APIs (Speech AI, NLP Suite, Image Processing) is not used to train Brainiall models or any third-party models. Enterprise contracts include an explicit no-training clause.

2. Compliance & Certifications

Brainiall platforms are designed to comply with LGPD (Lei Geral de Proteção de Dados, Brazil), GDPR (EU), and CCPA (California) where applicable to the customer relationship.

SOC 2 Type II audit: target for Q1 2027. Observation period began Q2 2026. Letters of pre-audit engagement available under NDA.

ISO 27001 certification: roadmap target Q2 2027.

Deployments follow the zones and conduits defined by the plant (IEC 62443-3-2). Safety instrumented systems (IEC 61511 / ISA-84) and interlocks stay independent and are never touched.

A current-state compliance deck and a security whitepaper are available under NDA. Request via security@brainiall.com.

3. Data Residency

Brazilian customers: LGPD-compliant data processing. No customer-submitted prompts or data leave Brazilian territory unless explicitly configured.

Speech AI, NLP Suite, and Image Processing: US and EU regions available. Customers may request region-pinning at contract time.

AI Autopilot: deployment options include customer cloud (any region), on-premise edge appliances, and air-gapped installations. No plant telemetry leaves the customer network without explicit configuration.

4. Sub-Processors

Website hosting: Oracle Cloud Infrastructure. Email: Microsoft 365. Website analytics: Plausible. Systems that process customer data run in the customer's cloud or on premises, as defined in each engagement and listed in the DPA.

A current sub-processors list is available under NDA.

5. Responsible Disclosure

We welcome responsible security research. To report a vulnerability or an incident, email contactus@brainiall.com. PGP key available on request. Support hours are defined in each contract.

Please do not perform destructive testing, social engineering of Brainiall staff, or testing against production customer data. Testing against public demo environments and documented API surfaces is acceptable.

6. Access Controls & Customer Governance

Enterprise tenants support SSO via SAML 2.0 and SCIM provisioning. API keys are scoped to a project and can be rotated or revoked from the customer dashboard.

Role-based access control (RBAC) is available with granular permissions for admin, developer, and viewer roles. Customer-facing audit logs are exportable in JSON and CSV.

7. Business Continuity & Incident Response

Production services and Specialist AI APIs (Speech AI, NLP Suite, Image Processing) are actively monitored. For AI Autopilot, customer control systems remain the authoritative fallback.

Support hours and incident response are defined in each contract. Confirmed incidents affecting customer data are notified under the terms of the contract and the DPA. Current status: see /status.

8. Contact

Security & trust: security@brainiall.com

Privacy & data protection (DPO / Encarregado): privacy@brainiall.com

Enterprise legal & contracts: legal@brainiall.com